Harden OpenCode compatibility CI and watcher

README.md

@@ -10,6 +10,9 @@ prompts, credentials, sessions, or user data belong here.
 
 - A gem release is a candidate until the fixture suite and every required image
   profile pass.
+- `opencode-ruby` and `opencode-rails` are one candidate release train. The
+  manifest records both peeled commits, and CI rejects a Rails candidate whose
+  exact runtime dependency resolves to a different Ruby version or commit.
 - Image references are immutable OCI index digests. A tag may be recorded as
   human-readable provenance, but it is never an execution coordinate.
 - Custom consumer images are certified with an isolated canary on the host that
@@ -46,11 +49,26 @@ Prerequisites are Ruby 3.2+, Python 3, `jq`, and Docker.
 ruby test/repository_test.rb
 ruby test/runtime_tuple_promoter_test.rb
 ruby test/exact_live_contract_test.rb
+ruby test/watcher_test.rb
 OPENCODE_RUBY_PATH=/path/to/opencode-ruby-at-78b6f9c9e9c7d58b699af1c3c17764acd33de798 \
   ruby ruby/opencode_ruby_fixture_contract.rb
+BUNDLE_GEMFILE=/path/to/opencode-rails/Gemfile \
+OPENCODE_RUBY_PATH=/path/to/opencode-ruby \
+OPENCODE_RAILS_PATH=/path/to/opencode-rails \
+OPENCODE_RUBY_COMMIT=FULL_40_HEX_COMMIT \
+OPENCODE_RUBY_TAG=v0.0.1.alpha7 \
+OPENCODE_RUBY_TAG_OBJECT=FULL_40_HEX_ANNOTATED_TAG_OBJECT \
+OPENCODE_RAILS_COMMIT=FULL_40_HEX_COMMIT \
+OPENCODE_RAILS_TAG=v0.0.1.alpha7 \
+OPENCODE_RAILS_TAG_OBJECT=FULL_40_HEX_ANNOTATED_TAG_OBJECT \
+OPENCODE_RUBY_VERSION=0.0.1.alpha7 \
+OPENCODE_RAILS_VERSION=0.0.1.alpha7 \
+  bundle exec ruby ruby/lockstep_client_contract.rb
+BUNDLE_GEMFILE=/path/to/opencode-ruby-at-78b6f9c9e9c7d58b699af1c3c17764acd33de798/Gemfile \
 OPENCODE_RUBY_PATH=/path/to/opencode-ruby-at-78b6f9c9e9c7d58b699af1c3c17764acd33de798 \
+OPENCODE_RUBY_COMMIT=78b6f9c9e9c7d58b699af1c3c17764acd33de798 \
 OPENCODE_IMAGE='ghcr.io/anomalyco/opencode@sha256:e975a0647576016dfdf77d54b979ca30d32b4750472c10263e9894aad6628c2a' \
-  scripts/run_image_contract.sh
+  bundle exec scripts/run_image_contract.sh
 ```
 
 The live contract starts a deterministic local OpenAI-compatible model stub and
@@ -58,15 +76,31 @@ an isolated OpenCode container. It creates a session, subscribes, submits an
 async prompt, observes terminal SSE, fetches the authoritative exchange, and
 deletes the session. Passing requires the authoritative final text to equal the
 expected text byte-for-byte and the deterministic model stub to observe exactly
-one request. It never calls an external model provider.
+one request and exactly one authoritative assistant message. It never calls an
+external model provider.
+
+Candidate CI uploads machine-readable fixture, lockstep-client, and exact-image
+evidence for 30 days. These artifacts are review inputs, not certification by
+themselves. A person must review a passing artifact and commit the durable
+certification document under `evidence/`; no workflow commits or promotes its
+own result.
 
 ## Adding an upstream release
 
-The scheduled watcher compares the latest upstream GitHub release with the
-manifest. When a new release appears, it resolves the tag to an OCI digest and
-opens a compatibility PR. The PR adds a pending image-matrix entry, which runs
-the candidate suite. A person still decides whether to promote it and update
-consumers.
+The scheduled watcher compares both the latest upstream GitHub release tag and
+its resolved OCI digest with the manifest. A new release or a changed digest
+behind an existing tag gets a digest-specific branch and compatibility PR. The
+PR adds a pending image-matrix entry, which runs the candidate suite after the
+normal GitHub workflow approval boundary. A person still decides whether to
+promote it and update consumers. The watcher never merges, dispatches consumer
+workflows, deploys, or force-pushes.
+
+`public_ci` is the active compatibility set, not an append-only release log.
+Keep images still referenced by a consumer's current, candidate, or previous
+runtime tuple plus the newest pending upstream candidate. When a watcher PR
+supersedes an unreferenced pending target, remove that older row during review;
+durable certification documents and Git history are the archive. This keeps a
+fast-moving upstream from making every future run retest every old release.
 
 See [docs/certification.md](docs/certification.md) for promotion, canary, and
 rollback evidence requirements.